diff --git a/modules/wafrn.nix b/modules/wafrn.nix
index b4da4de..2b6fd06 100644
--- a/modules/wafrn.nix
+++ b/modules/wafrn.nix
@@ -374,13 +374,26 @@ in
         RemainAfterExit = true;
       };
       script = ''
+        set -euo pipefail
+
+        if [ ! -d "${cfg.source}" ]; then
+          echo "wafrn-nix: source directory does not exist: ${cfg.source}" >&2
+          exit 1
+        fi
+
         if [ ! -f "${cfg.source}/package-lock.json" ]; then
           echo "wafrn-nix: package-lock.json missing, generating with npm" >&2
-          (cd "${cfg.source}" && npm install --package-lock-only --ignore-scripts)
+          if ! (cd "${cfg.source}" && npm install --package-lock-only --ignore-scripts); then
+            echo "wafrn-nix: failed to generate package-lock.json, continuing with existing source" >&2
+          fi
         fi
 
         install -m 0600 ${envTemplate} ${serviceEnvFile}
         ${optionalString (cfg.secretsFile != null) ''
+          if [ ! -f "${cfg.secretsFile}" ]; then
+            echo "wafrn-nix: secretsFile does not exist: ${cfg.secretsFile}" >&2
+            exit 1
+          fi
           cat "${cfg.secretsFile}" >> ${serviceEnvFile}
         ''}
         install -m 0644 ${composeTemplate} ${composeFile}